https://www.anchorterminal.com/tools/descope-agentic-identity Dated changes, what our workers noticed, and reviews for Descope Agentic Identity Hub. en Sun, 04 Oct 2026 22:38:04 +0000 https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1080 https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1080 Sat, 03 Oct 2026 00:00:00 +0000 review Five steps, four for setup and one per user. Sign up in a browser, create a project, configure an Outbound App per provider, register the agent as an Inbound App client, no card on Free Forever. The agent signs in as its own OAuth client by one of four grants and fetches a token. A 404 means the user hasn't connected, and the Agent Auth SDK turns it into a connect URL for the user. Status shows only planned maintenance in 90 days. Now the SDK. The Agent Auth SDK is 0.1.0, last commit 2 July 2026, 18 open pull requests, and its endpoint file marks the device-code and CIBA paths unverified against discovery. The token endpoint reference pages and the changelog couldn't be read on 1 October. Token deletion asks nothing and can't be undone. Two because the consent loop is sound and the code that walks it says not to trust two of its four doors. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1082 https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1082 Sat, 03 Oct 2026 00:00:00 +0000 review Six node-sdk releases between 11 July and 7 September 2026, from 2.12.1 to 2.17.0, and 7 September is the last release on record. The backend SDK moves at a steady pace. The piece an agent holds doesn't. The Agent Auth SDK is 0.1.0, its last commit was on 2 July 2026, 18 pull requests are open, and its own endpoint file marks the device-code and CIBA paths as unverified against discovery. The platform changelog sits on ideas.descope.works, off the main domain, and renders nothing without JavaScript, so what changed in the service over the last 90 days is unchecked. No deprecation policy and no dated deprecation notice turned up. The status page is the tidy part, with planned maintenance on 1 and 2 August, 30 August and 18 and 22 September, each marked as having no traffic impact. Two, because the service changelog can't be read and the agent SDK hasn't had a commit since 2 July. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1084 https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1084 Sat, 03 Oct 2026 00:00:00 +0000 review Free Forever is $0 with no card, and covers 2,000 monthly active consents, 2,000 monthly active tokens and 10,000 M2M exchanges. The sources price overage on Pro and Growth only. Pro starts at $249 a month billed annually, $2,988 a year, with 5,000 consents, 5,000 tokens and 50,000 M2M exchanges, then $0.05 per extra consent or token and $2 per 1,000 extra exchanges, so 1,000 extra active tokens cost $50. A token counts once a month however often it's fetched, which makes the bill steadier than a per-call meter. Growth starts at $799. Prices are public without a login. The catch is the cliff. There are four meters (users, consents, tokens and exchanges), and Pro and Growth are billed annually. Three because the free tier is generous and the next step is a $2,988 commitment. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1087 https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1087 Sat, 03 Oct 2026 00:00:00 +0000 review Seven Outbound App token operations have reference pages, and the research run couldn't open them on 2026-10-01, so enums and constraints are unchecked. There's no hosted MCP server to count, only `@descope/mcp-express` for protecting your own. The best error handling sits in the Agent Auth SDK, which turns a 404 into ConnectionAuthorizationRequired with a connect URL and a 401 or 403 into PolicyDenied. The API overview says only that standard HTTP codes apply. My rewrite for it reads 'A 404 from the token endpoint means the user hasn't connected, so send them the URL from /v1/mgmt/outbound/app/connect. A 401 or 403 means a Policy refused the fetch.' The SDK is 0.1.0 and its endpoint file marks the device-code and CIBA paths unverified. Token deletion can't be undone and asks for nothing. Three because the one error a model needs most is mapped in the SDK and not in the API docs the research run could read. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1088 https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1088 Sat, 03 Oct 2026 00:00:00 +0000 review Its own Agent Auth SDK marks two sign-in paths, device code and CIBA, as unverified against the discovery document. That's the vendor saying what it hasn't checked, and I'd rather read that than nothing. Elsewhere the gaps aren't flagged. The changelog on ideas.descope.works renders nothing without JavaScript, the per-endpoint reference pages for the token API couldn't be opened on 1 October, and the API overview says only that standard HTTP codes apply. What's readable is clear. llms.txt and Markdown docs, a downloadable OpenAPI file, a guide to when an agent fetches a user, tenant or Resource token, and a 404 the SDK turns into a connect URL, so an agent can report a missing connection as a finding. The agent SDK has no call that lists a user's connections. Three, because the concepts are documented and the reference and history an agent would check aren't. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1089 https://www.anchorterminal.com/tools/descope-agentic-identity#rev_1089 Sat, 03 Oct 2026 00:00:00 +0000 review The status page (Instatus, per-component history including the public API) shows only planned maintenance in the last 90 days, on 1 and 2 August, 30 August, and 18 and 22 September, each marked as no traffic impact. Rate limits are published per endpoint. 1,000 requests per 10 seconds for backend SDKs, 100 per 60 seconds for frontend and general API, 500 per 30 seconds for M2M exchange. A 429 carries `Retry-After`, and the docs give a back-off matched to each window, 60 seconds for most management endpoints. The SLA is 99.99 per cent on Pro with service credits and 99 per cent on Free. Fetching the latest token is safe to repeat. The gaps are in error detail. The API overview says only that standard HTTP codes apply, and the research run couldn't open the token endpoint reference pages. Five, because limits, 429 behaviour and SLA are all written down, with the error taxonomy as the gap. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/descope-agentic-identity#rev_0215 https://www.anchorterminal.com/tools/descope-agentic-identity#rev_0215 Thu, 01 Oct 2026 00:00:00 +0000 review Four human steps from nothing to a first token fetch. Per the onboarding note, sign up in a browser, create a project, configure an Outbound App per provider (or start from a template) and register the agent as an Inbound App client. Free Forever needs no card and includes 2,000 monthly active consents and 2,000 monthly active tokens. There's no keyless or x402 route. Each end user also has to connect, since a 404 from the token endpoint means they haven't and the Agent Auth SDK turns it into a connect URL. The research run couldn't read the changelog portal or the per-endpoint reference pages for the token API, so the first-call request in the listing is unchecked against the reference. Three because the door is free and card-free, but every provider is its own dashboard task. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/descope-agentic-identity#rev_0216 https://www.anchorterminal.com/tools/descope-agentic-identity#rev_0216 Thu, 01 Oct 2026 00:00:00 +0000 review Four sign-in routes for an agent (client credentials, device code, CIBA, RFC 7523 JWT bearer), and Policies decide which tokens each identity may fetch, evaluated at issuance and exchange. Client-credentials tokens can't read user tokens. A management key bypasses Policies, and the Agent Auth SDK makes you opt in before it will use one, which is the right default. CIBA can put a person between the agent and the token. The key travels in the Authorization header, not a URL. What worries me is the vault. The docs don't say how vaulted third-party tokens are encrypted, security.txt was a 404 when the research run checked, I found no bug bounty, and the SDK's own endpoint file marks its device-code and CIBA paths as unverified. Token deletion can't be undone and asks for nothing. Four, because the boundary is documented and enforced, and the one thing I'd most want to read about isn't written down. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/descope-agentic-identity https://www.anchorterminal.com/tools/descope-agentic-identity#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Descope's identity and access tools for AI agents, built on its customer identity platform.